Privacy Policy
Last updated: 22 August 2026
SearchScore ("we", "us", "our") is operated by Product Specialists LTD, a company registered in England and Wales. We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Data Controller: Product Specialists LTD (company no. 12575770)
Registered address: Afe Accountants Limited, Building 3 North London Business Park, Oakleigh Road South, London, England, N11 1GN
Contact: [email protected]
2. What data we collect
| Data | When collected | Purpose |
|---|---|---|
| Website URL you audit | When you run an audit | To perform the AI visibility analysis |
| Email address | When you unlock a full report or subscribe | To deliver your report and send relevant updates |
| Payment data | At checkout | Processed by Stripe - we never store card details |
| IP address & browser data | Automatically on visit | Security, analytics, fraud prevention |
| Cookies & tracking pixels | On page load (with consent) | Analytics and advertising (see section 6) |
2A. Website chat
If you choose to use SearchScore chat, we process the messages you send so we can answer your enquiry. We may also attach limited first-party context that is already available on the SearchScore page, such as the page path, the website being audited and its SearchScore scores, where available. We do not send page query strings, authentication tokens, payment details or cookies with chat messages.
The chat service is hosted on Cloudflare and messages are relayed to an authorised SearchScore operator through Telegram. Telegram is used as our operator message-delivery channel; the visitor does not need a Telegram account.
When you start a conversation, a random conversation identifier and secret are stored in your browser so the chat can survive page changes and refreshes. The server stores only a hash of the secret. We use a keyed hash derived from network information for abuse prevention rather than retaining the raw IP address in the chat database, and those rate-limit records are deleted after two days.
We use chat data only to provide the conversation, maintain service security and troubleshoot delivery. Chat transcripts are not added to marketing lists and are not used to train AI models by default. Conversations, message bodies and Telegram routing records are deleted after 30 days of inactivity.
Our legal basis is our legitimate interest in answering enquiries and operating a secure customer service channel, and where your enquiry relates to a service you have requested or purchased, taking steps to provide that service.
3. Legal basis for processing
- Contract performance - processing your audit and delivering paid reports
- Legitimate interests - improving our service, fraud prevention, security
- Consent - marketing emails and advertising cookies (you can withdraw at any time)
- Legal obligation - retaining financial records as required by law
4. How we use your data
- To run AI visibility audits on the URLs you submit
- To deliver paid reports and manage your subscription
- To send transactional emails related to your account
- To send marketing emails (only with your consent, unsubscribe any time)
- To improve our scoring algorithm and product
- To prevent fraud and abuse of our platform
5. Who we share data with
| Third party | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | US (EU-US Data Privacy Framework) |
| Brevo (Sendinblue) | Email delivery | EU |
| GoHighLevel | CRM and lead management | US (Standard Contractual Clauses) |
| Cloudflare | Hosting and CDN | EU/US (adequacy decision) |
| Google Analytics | Website analytics | US (consent-based) |
| Meta (Facebook) | Advertising analytics | US (consent-based) |
| Microsoft Clarity | Session recording and heatmaps | US (consent-based) |
| X (Twitter) | Advertising analytics | US (consent-based) |
We do not sell your personal data to any third party.
6. Cookies and tracking
We use the following types of cookies and tracking technologies:
- Essential cookies - required for the site to function (no consent needed)
- Analytics cookies - Google Analytics, Microsoft Clarity (require consent)
- Advertising pixels - Meta Pixel, X Pixel, Google Ads (require consent)
You can manage your cookie preferences at any time via our cookie banner or by contacting us.
7. Your rights
Under UK GDPR you have the right to:
- Access - request a copy of the personal data we hold about you
- Rectification - ask us to correct inaccurate data
- Erasure - ask us to delete your data ("right to be forgotten")
- Restriction - ask us to limit how we use your data
- Portability - receive your data in a portable format
- Object - object to processing based on legitimate interests
- Withdraw consent - at any time, for consent-based processing
To exercise any right, email [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
8. Data retention
- Audit results - retained indefinitely to power our dataset (no personal data attached to public scores)
- Email addresses - retained until you unsubscribe or request deletion
- Payment records - retained for 7 years as required by HMRC
- Session and log data - deleted after 90 days
9. The SearchScore app for HighLevel
If your company installs our app from the HighLevel Marketplace (AI & SEO Pipeline Revenue Hunter by SearchScore), we process data from your CRM on your instructions. For that data you are the controller and we act as your processor. This section says what we access, what we keep, and how it is deleted.
What we access
Installing grants us permission to read contacts, opportunities, locations, users and workflows in the account you choose, and to write to contacts and opportunities. We use that access to:
- read the website, company name and CRM contact reference of the contacts you choose to import as prospects;
- write scores, findings and tags back to those contacts and opportunities when you ask us to, reading the existing tags first so none are removed;
- post to your workflows when a watched score changes, if you have set that up.
The contact records your CRM returns pass through our servers during an import, but we keep only the website, the company name and the CRM contact and opportunity references. When you have us create or update a contact, any name, email address or phone number you supply is sent to your CRM and is not stored by us.
What we store
- Your CRM access tokens, encrypted at rest (AES-256-GCM)
- For each prospect: the website, company name, CRM references, and the scores, findings, scans, reports and monitoring readings we produce for it
- A log of actions taken in the app, and billing records, which are held by Stripe
Live AI recommendation checks
When you run a live check on a prospect, we send that business's name and website, together with the buying questions we generate, to the AI assistants being tested (through OpenRouter and Google) and to DataForSEO for Google's AI surfaces. No personal data about your contacts is sent to any of them.
Retention and deletion
- Uninstalling the app revokes our access tokens immediately, stops all monitoring and workflow activity, and ends any subscription at the close of the paid period. Your prospect data is kept so you can reinstall without losing it.
- To have everything erased, email [email protected] from the installing account. We delete every record for your installation in one operation and confirm when it is done.
- Activity logs are removed on a schedule: workflow deliveries after 30 days, usage events after 180 days, monitoring history after one year.
- Scores, scans and reports you have paid for are kept until you ask for erasure, because they are your purchase record.
10. Security
We use industry-standard security measures including TLS encryption in transit, access controls, and regular security reviews. Payment data is processed exclusively by Stripe and never stored on our servers.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of SearchScore after changes constitutes acceptance of the updated policy.
12. Contact
For any privacy-related queries: [email protected]